<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
    <title>ActionController::HttpAuthentication::Digest</title>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <link rel="stylesheet" href="../../../css/reset.css" type="text/css" media="screen" />
<link rel="stylesheet" href="../../../css/main.css" type="text/css" media="screen" />
<link rel="stylesheet" href="../../../css/github.css" type="text/css" media="screen" />
<script src="../../../js/jquery-1.3.2.min.js" type="text/javascript" charset="utf-8"></script>
<script src="../../../js/jquery-effect.js" type="text/javascript" charset="utf-8"></script>
<script src="../../../js/main.js" type="text/javascript" charset="utf-8"></script>
<script src="../../../js/highlight.pack.js" type="text/javascript" charset="utf-8"></script>

</head>

<body>     
    <div class="banner">
        
            <span>Ruby on Rails v4.0.0</span><br />
        
        <h1>
            <span class="type">Module</span> 
            ActionController::HttpAuthentication::Digest 
            
        </h1>
        <ul class="files">
            
            <li><a href="../../../files/actionpack/lib/action_controller/metal/http_authentication_rb.html">actionpack/lib/action_controller/metal/http_authentication.rb</a></li>
            
        </ul>
    </div>
    <div id="bodyContent">
        <div id="content">
  
    <div class="description">
      
<p>Makes it dead easy to do HTTP Digest authentication.</p>

<h3 id="label-Simple+Digest+example">Simple Digest example</h3>

<pre class="ruby"><span class="ruby-identifier">require</span> <span class="ruby-string">'digest/md5'</span>
<span class="ruby-keyword">class</span> <span class="ruby-constant">PostsController</span> <span class="ruby-operator">&lt;</span> <span class="ruby-constant">ApplicationController</span>
  <span class="ruby-constant">REALM</span> = <span class="ruby-string">&quot;SuperSecret&quot;</span>
  <span class="ruby-constant">USERS</span> = {<span class="ruby-string">&quot;dhh&quot;</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-string">&quot;secret&quot;</span>, <span class="ruby-comment">#plain text password</span>
           <span class="ruby-string">&quot;dap&quot;</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-constant">Digest</span><span class="ruby-operator">::</span><span class="ruby-constant">MD5</span>.<span class="ruby-identifier">hexdigest</span>([<span class="ruby-string">&quot;dap&quot;</span>,<span class="ruby-constant">REALM</span>,<span class="ruby-string">&quot;secret&quot;</span>].<span class="ruby-identifier">join</span>(<span class="ruby-string">&quot;:&quot;</span>))}  <span class="ruby-comment">#ha1 digest password</span>

  <span class="ruby-identifier">before_action</span> :<span class="ruby-identifier">authenticate</span>, <span class="ruby-identifier">except</span><span class="ruby-operator">:</span> [:<span class="ruby-identifier">index</span>]

  <span class="ruby-keyword">def</span> <span class="ruby-identifier">index</span>
    <span class="ruby-identifier">render</span> <span class="ruby-identifier">text</span><span class="ruby-operator">:</span> <span class="ruby-string">&quot;Everyone can see me!&quot;</span>
  <span class="ruby-keyword">end</span>

  <span class="ruby-keyword">def</span> <span class="ruby-identifier">edit</span>
    <span class="ruby-identifier">render</span> <span class="ruby-identifier">text</span><span class="ruby-operator">:</span> <span class="ruby-string">&quot;I'm only accessible if you know the password&quot;</span>
  <span class="ruby-keyword">end</span>

  <span class="ruby-identifier">private</span>
    <span class="ruby-keyword">def</span> <span class="ruby-identifier">authenticate</span>
      <span class="ruby-identifier">authenticate_or_request_with_http_digest</span>(<span class="ruby-constant">REALM</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">username</span><span class="ruby-operator">|</span>
        <span class="ruby-constant">USERS</span>[<span class="ruby-identifier">username</span>]
      <span class="ruby-keyword">end</span>
    <span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
</pre>

<h3 id="label-Notes">Notes</h3>

<p>The <code>authenticate_or_request_with_http_digest</code> block must return
the user’s password or the ha1 digest hash so the framework can
appropriately hash to check the user’s credentials. Returning
<code>nil</code> will cause authentication to fail.</p>

<p>Storing the ha1 hash: MD5(username:realm:password), is better than storing
a plain password. If the password file or database is compromised, the
attacker would be able to use the ha1 hash to authenticate as the user at
this <code>realm</code>, but would not have the user’s password to try
using at other sites.</p>

<p>In rare instances, web servers or front proxies strip authorization headers
before they reach your application. You can debug this situation by logging
all environment variables, and check for HTTP_AUTHORIZATION, amongst
others.</p>

    </div>
  


  


  
  


  
    <!-- Namespace -->
    <div class="sectiontitle">Namespace</div>
    <ul>
      
        <li>
          <span class="type">MODULE</span>
          <a href="Digest/ControllerMethods.html">ActionController::HttpAuthentication::Digest::ControllerMethods</a>
        </li>
      
    </ul>
  


  
    <!-- Method ref -->
    <div class="sectiontitle">Methods</div>
    <dl class="methods">
      
        <dt>A</dt>
        <dd>
          <ul>
            
              
              <li>
                <a href="Digest.html#method-i-authenticate">authenticate</a>,
              </li>
            
              
              <li>
                <a href="Digest.html#method-i-authentication_header">authentication_header</a>,
              </li>
            
              
              <li>
                <a href="Digest.html#method-i-authentication_request">authentication_request</a>
              </li>
            
          </ul>
        </dd>
      
        <dt>D</dt>
        <dd>
          <ul>
            
              
              <li>
                <a href="Digest.html#method-i-decode_credentials">decode_credentials</a>,
              </li>
            
              
              <li>
                <a href="Digest.html#method-i-decode_credentials_header">decode_credentials_header</a>
              </li>
            
          </ul>
        </dd>
      
        <dt>E</dt>
        <dd>
          <ul>
            
              
              <li>
                <a href="Digest.html#method-i-encode_credentials">encode_credentials</a>,
              </li>
            
              
              <li>
                <a href="Digest.html#method-i-expected_response">expected_response</a>
              </li>
            
          </ul>
        </dd>
      
        <dt>H</dt>
        <dd>
          <ul>
            
              
              <li>
                <a href="Digest.html#method-i-ha1">ha1</a>
              </li>
            
          </ul>
        </dd>
      
        <dt>N</dt>
        <dd>
          <ul>
            
              
              <li>
                <a href="Digest.html#method-i-nonce">nonce</a>
              </li>
            
          </ul>
        </dd>
      
        <dt>O</dt>
        <dd>
          <ul>
            
              
              <li>
                <a href="Digest.html#method-i-opaque">opaque</a>
              </li>
            
          </ul>
        </dd>
      
        <dt>S</dt>
        <dd>
          <ul>
            
              
              <li>
                <a href="Digest.html#method-i-secret_token">secret_token</a>
              </li>
            
          </ul>
        </dd>
      
        <dt>V</dt>
        <dd>
          <ul>
            
              
              <li>
                <a href="Digest.html#method-i-validate_digest_response">validate_digest_response</a>,
              </li>
            
              
              <li>
                <a href="Digest.html#method-i-validate_nonce">validate_nonce</a>
              </li>
            
          </ul>
        </dd>
      
    </dl>
  

  



  

    

    

    


    


    <!-- Methods -->
        
      <div class="sectiontitle">Instance Public methods</div>
      
        <div class="method">
          <div class="title method-title" id="method-i-authenticate">
            
              <b>authenticate</b>(request, realm, &amp;password_procedure)
            
            <a href="Digest.html#method-i-authenticate" name="method-i-authenticate" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              <p>Returns false on a valid response, true otherwise</p>
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-authenticate_source')" id="l_method-i-authenticate_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L179" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-authenticate_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 179</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">authenticate</span>(<span class="ruby-identifier">request</span>, <span class="ruby-identifier">realm</span>, &amp;<span class="ruby-identifier">password_procedure</span>)
  <span class="ruby-identifier">request</span>.<span class="ruby-identifier">authorization</span> <span class="ruby-operator">&amp;&amp;</span> <span class="ruby-identifier">validate_digest_response</span>(<span class="ruby-identifier">request</span>, <span class="ruby-identifier">realm</span>, &amp;<span class="ruby-identifier">password_procedure</span>)
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-authentication_header">
            
              <b>authentication_header</b>(controller, realm)
            
            <a href="Digest.html#method-i-authentication_header" name="method-i-authentication_header" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-authentication_header_source')" id="l_method-i-authentication_header_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L237" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-authentication_header_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 237</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">authentication_header</span>(<span class="ruby-identifier">controller</span>, <span class="ruby-identifier">realm</span>)
  <span class="ruby-identifier">secret_key</span> = <span class="ruby-identifier">secret_token</span>(<span class="ruby-identifier">controller</span>.<span class="ruby-identifier">request</span>)
  <span class="ruby-identifier">nonce</span> = <span class="ruby-keyword">self</span>.<span class="ruby-identifier">nonce</span>(<span class="ruby-identifier">secret_key</span>)
  <span class="ruby-identifier">opaque</span> = <span class="ruby-identifier">opaque</span>(<span class="ruby-identifier">secret_key</span>)
  <span class="ruby-identifier">controller</span>.<span class="ruby-identifier">headers</span>[<span class="ruby-string">&quot;WWW-Authenticate&quot;</span>] = <span class="ruby-node">%Q(Digest realm=&quot;#{realm}&quot;, qop=&quot;auth&quot;, algorithm=MD5, nonce=&quot;#{nonce}&quot;, opaque=&quot;#{opaque}&quot;)</span>
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-authentication_request">
            
              <b>authentication_request</b>(controller, realm, message = nil)
            
            <a href="Digest.html#method-i-authentication_request" name="method-i-authentication_request" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-authentication_request_source')" id="l_method-i-authentication_request_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L244" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-authentication_request_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 244</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">authentication_request</span>(<span class="ruby-identifier">controller</span>, <span class="ruby-identifier">realm</span>, <span class="ruby-identifier">message</span> = <span class="ruby-keyword">nil</span>)
  <span class="ruby-identifier">message</span> <span class="ruby-operator">||=</span> <span class="ruby-string">&quot;HTTP Digest: Access denied.\n&quot;</span>
  <span class="ruby-identifier">authentication_header</span>(<span class="ruby-identifier">controller</span>, <span class="ruby-identifier">realm</span>)
  <span class="ruby-identifier">controller</span>.<span class="ruby-identifier">response_body</span> = <span class="ruby-identifier">message</span>
  <span class="ruby-identifier">controller</span>.<span class="ruby-identifier">status</span> = <span class="ruby-number">401</span>
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-decode_credentials">
            
              <b>decode_credentials</b>(header)
            
            <a href="Digest.html#method-i-decode_credentials" name="method-i-decode_credentials" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-decode_credentials_source')" id="l_method-i-decode_credentials_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L230" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-decode_credentials_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 230</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">decode_credentials</span>(<span class="ruby-identifier">header</span>)
  <span class="ruby-constant">ActiveSupport</span><span class="ruby-operator">::</span><span class="ruby-constant">HashWithIndifferentAccess</span>[<span class="ruby-identifier">header</span>.<span class="ruby-identifier">to_s</span>.<span class="ruby-identifier">gsub</span>(<span class="ruby-regexp">/^Digest\s+/</span>, <span class="ruby-string">''</span>).<span class="ruby-identifier">split</span>(<span class="ruby-string">','</span>).<span class="ruby-identifier">map</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">pair</span><span class="ruby-operator">|</span>
    <span class="ruby-identifier">key</span>, <span class="ruby-identifier">value</span> = <span class="ruby-identifier">pair</span>.<span class="ruby-identifier">split</span>(<span class="ruby-string">'='</span>, <span class="ruby-number">2</span>)
    [<span class="ruby-identifier">key</span>.<span class="ruby-identifier">strip</span>, <span class="ruby-identifier">value</span>.<span class="ruby-identifier">to_s</span>.<span class="ruby-identifier">gsub</span>(<span class="ruby-regexp">/^&quot;|&quot;$/</span>,<span class="ruby-string">''</span>).<span class="ruby-identifier">delete</span>(<span class="ruby-string">'\'</span>)]
  <span class="ruby-keyword">end</span>]
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-decode_credentials_header">
            
              <b>decode_credentials_header</b>(request)
            
            <a href="Digest.html#method-i-decode_credentials_header" name="method-i-decode_credentials_header" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-decode_credentials_header_source')" id="l_method-i-decode_credentials_header_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L226" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-decode_credentials_header_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 226</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">decode_credentials_header</span>(<span class="ruby-identifier">request</span>)
  <span class="ruby-identifier">decode_credentials</span>(<span class="ruby-identifier">request</span>.<span class="ruby-identifier">authorization</span>)
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-encode_credentials">
            
              <b>encode_credentials</b>(http_method, credentials, password, password_is_ha1)
            
            <a href="Digest.html#method-i-encode_credentials" name="method-i-encode_credentials" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-encode_credentials_source')" id="l_method-i-encode_credentials_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L221" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-encode_credentials_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 221</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">encode_credentials</span>(<span class="ruby-identifier">http_method</span>, <span class="ruby-identifier">credentials</span>, <span class="ruby-identifier">password</span>, <span class="ruby-identifier">password_is_ha1</span>)
  <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:response</span>] = <span class="ruby-identifier">expected_response</span>(<span class="ruby-identifier">http_method</span>, <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:uri</span>], <span class="ruby-identifier">credentials</span>, <span class="ruby-identifier">password</span>, <span class="ruby-identifier">password_is_ha1</span>)
  <span class="ruby-string">&quot;Digest &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">credentials</span>.<span class="ruby-identifier">sort_by</span> {<span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span> <span class="ruby-identifier">x</span>[<span class="ruby-number">0</span>].<span class="ruby-identifier">to_s</span> }.<span class="ruby-identifier">map</span> {<span class="ruby-operator">|</span><span class="ruby-identifier">v</span><span class="ruby-operator">|</span> <span class="ruby-node">&quot;#{v[0]}='#{v[1]}'&quot;</span> }.<span class="ruby-identifier">join</span>(<span class="ruby-string">', '</span>)
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-expected_response">
            
              <b>expected_response</b>(http_method, uri, credentials, password, password_is_ha1=true)
            
            <a href="Digest.html#method-i-expected_response" name="method-i-expected_response" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              <p>Returns the expected response for a request of <code>http_method</code> to
<code>uri</code> with the decoded <code>credentials</code> and the expected
<code>password</code> Optional parameter <code>password_is_ha1</code> is
set to <code>true</code> by default, since best practice is to store ha1
digest instead of a plain-text password.</p>
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-expected_response_source')" id="l_method-i-expected_response_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L211" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-expected_response_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 211</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">expected_response</span>(<span class="ruby-identifier">http_method</span>, <span class="ruby-identifier">uri</span>, <span class="ruby-identifier">credentials</span>, <span class="ruby-identifier">password</span>, <span class="ruby-identifier">password_is_ha1</span>=<span class="ruby-keyword">true</span>)
  <span class="ruby-identifier">ha1</span> = <span class="ruby-identifier">password_is_ha1</span> <span class="ruby-operator">?</span> <span class="ruby-identifier">password</span> <span class="ruby-operator">:</span> <span class="ruby-identifier">ha1</span>(<span class="ruby-identifier">credentials</span>, <span class="ruby-identifier">password</span>)
  <span class="ruby-identifier">ha2</span> = <span class="ruby-operator">::</span><span class="ruby-constant">Digest</span><span class="ruby-operator">::</span><span class="ruby-constant">MD5</span>.<span class="ruby-identifier">hexdigest</span>([<span class="ruby-identifier">http_method</span>.<span class="ruby-identifier">to_s</span>.<span class="ruby-identifier">upcase</span>, <span class="ruby-identifier">uri</span>].<span class="ruby-identifier">join</span>(<span class="ruby-string">':'</span>))
  <span class="ruby-operator">::</span><span class="ruby-constant">Digest</span><span class="ruby-operator">::</span><span class="ruby-constant">MD5</span>.<span class="ruby-identifier">hexdigest</span>([<span class="ruby-identifier">ha1</span>, <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:nonce</span>], <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:nc</span>], <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:cnonce</span>], <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:qop</span>], <span class="ruby-identifier">ha2</span>].<span class="ruby-identifier">join</span>(<span class="ruby-string">':'</span>))
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-ha1">
            
              <b>ha1</b>(credentials, password)
            
            <a href="Digest.html#method-i-ha1" name="method-i-ha1" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-ha1_source')" id="l_method-i-ha1_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L217" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-ha1_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 217</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">ha1</span>(<span class="ruby-identifier">credentials</span>, <span class="ruby-identifier">password</span>)
  <span class="ruby-operator">::</span><span class="ruby-constant">Digest</span><span class="ruby-operator">::</span><span class="ruby-constant">MD5</span>.<span class="ruby-identifier">hexdigest</span>([<span class="ruby-identifier">credentials</span>[<span class="ruby-value">:username</span>], <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:realm</span>], <span class="ruby-identifier">password</span>].<span class="ruby-identifier">join</span>(<span class="ruby-string">':'</span>))
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-nonce">
            
              <b>nonce</b>(secret_key, time = Time.now)
            
            <a href="Digest.html#method-i-nonce" name="method-i-nonce" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              <p>Uses an MD5 digest based on time to generate a value to be used only once.</p>

<p>A server-specified data string which should be uniquely generated each time
a 401 response is made. It is recommended that this string be base64 or
hexadecimal data. Specifically, since the string is passed in the header
lines as a quoted string, the double-quote character is not allowed.</p>

<p>The contents of the nonce are implementation dependent. The quality of the
implementation depends on a good choice. A nonce might, for example, be
constructed as the base 64 encoding of</p>

<pre>time-stamp H(time-stamp &quot;:&quot; ETag &quot;:&quot; private-key)</pre>

<p>where time-stamp is a server-generated time or other non-repeating value,
ETag is the value of the HTTP ETag header associated with the requested
entity, and private-key is data known only to the server. With a nonce of
this form a server would recalculate the hash portion after receiving the
client authentication header and reject the request if it did not match the
nonce from that header or if the time-stamp value is not recent enough. In
this way the server can limit the time of the nonce’s validity. The
inclusion of the ETag prevents a replay request for an updated version of
the resource. (Note: including the IP address of the client in the nonce
would appear to offer the server the ability to limit the reuse of the
nonce to the same client that originally got it. However, that would break
proxy farms, where requests from a single user often go through different
proxies in the farm. Also, IP address spoofing is not that hard.)</p>

<p>An implementation might choose not to accept a previously used nonce or a
previously used digest, in order to protect against a replay attack. Or, an
implementation might choose to use one-time nonces or digests for POST,
PUT, or PATCH requests and a time-stamp for GET requests. For more details
on the issues involved see Section 4 of this document.</p>

<p>The nonce is opaque to the client. Composed of <a
href="../../Time.html">Time</a>, and hash of <a
href="../../Time.html">Time</a> with secret key from the <a
href="../../Rails.html">Rails</a> session secret generated upon creation of
project. Ensures the time cannot be modified by client.</p>
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-nonce_source')" id="l_method-i-nonce_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L289" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-nonce_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 289</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">nonce</span>(<span class="ruby-identifier">secret_key</span>, <span class="ruby-identifier">time</span> = <span class="ruby-constant">Time</span>.<span class="ruby-identifier">now</span>)
  <span class="ruby-identifier">t</span> = <span class="ruby-identifier">time</span>.<span class="ruby-identifier">to_i</span>
  <span class="ruby-identifier">hashed</span> = [<span class="ruby-identifier">t</span>, <span class="ruby-identifier">secret_key</span>]
  <span class="ruby-identifier">digest</span> = <span class="ruby-operator">::</span><span class="ruby-constant">Digest</span><span class="ruby-operator">::</span><span class="ruby-constant">MD5</span>.<span class="ruby-identifier">hexdigest</span>(<span class="ruby-identifier">hashed</span>.<span class="ruby-identifier">join</span>(<span class="ruby-string">&quot;:&quot;</span>))
  <span class="ruby-operator">::</span><span class="ruby-constant">Base64</span>.<span class="ruby-identifier">strict_encode64</span>(<span class="ruby-node">&quot;#{t}:#{digest}&quot;</span>)
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-opaque">
            
              <b>opaque</b>(secret_key)
            
            <a href="Digest.html#method-i-opaque" name="method-i-opaque" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              <p>Opaque based on random generation - but changing each request?</p>
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-opaque_source')" id="l_method-i-opaque_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L308" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-opaque_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 308</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">opaque</span>(<span class="ruby-identifier">secret_key</span>)
  <span class="ruby-operator">::</span><span class="ruby-constant">Digest</span><span class="ruby-operator">::</span><span class="ruby-constant">MD5</span>.<span class="ruby-identifier">hexdigest</span>(<span class="ruby-identifier">secret_key</span>)
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-secret_token">
            
              <b>secret_token</b>(request)
            
            <a href="Digest.html#method-i-secret_token" name="method-i-secret_token" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-secret_token_source')" id="l_method-i-secret_token_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L251" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-secret_token_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 251</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">secret_token</span>(<span class="ruby-identifier">request</span>)
  <span class="ruby-identifier">key_generator</span>  = <span class="ruby-identifier">request</span>.<span class="ruby-identifier">env</span>[<span class="ruby-string">&quot;action_dispatch.key_generator&quot;</span>]
  <span class="ruby-identifier">http_auth_salt</span> = <span class="ruby-identifier">request</span>.<span class="ruby-identifier">env</span>[<span class="ruby-string">&quot;action_dispatch.http_auth_salt&quot;</span>]
  <span class="ruby-identifier">key_generator</span>.<span class="ruby-identifier">generate_key</span>(<span class="ruby-identifier">http_auth_salt</span>)
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-validate_digest_response">
            
              <b>validate_digest_response</b>(request, realm, &amp;password_procedure)
            
            <a href="Digest.html#method-i-validate_digest_response" name="method-i-validate_digest_response" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              <p>Returns false unless the request credentials response value matches the
expected value. First try the password as a ha1 digest password. If this
fails, then try it as a plain text password.</p>
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-validate_digest_response_source')" id="l_method-i-validate_digest_response_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L186" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-validate_digest_response_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 186</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">validate_digest_response</span>(<span class="ruby-identifier">request</span>, <span class="ruby-identifier">realm</span>, &amp;<span class="ruby-identifier">password_procedure</span>)
  <span class="ruby-identifier">secret_key</span>  = <span class="ruby-identifier">secret_token</span>(<span class="ruby-identifier">request</span>)
  <span class="ruby-identifier">credentials</span> = <span class="ruby-identifier">decode_credentials_header</span>(<span class="ruby-identifier">request</span>)
  <span class="ruby-identifier">valid_nonce</span> = <span class="ruby-identifier">validate_nonce</span>(<span class="ruby-identifier">secret_key</span>, <span class="ruby-identifier">request</span>, <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:nonce</span>])

  <span class="ruby-keyword">if</span> <span class="ruby-identifier">valid_nonce</span> <span class="ruby-operator">&amp;&amp;</span> <span class="ruby-identifier">realm</span> <span class="ruby-operator">==</span> <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:realm</span>] <span class="ruby-operator">&amp;&amp;</span> <span class="ruby-identifier">opaque</span>(<span class="ruby-identifier">secret_key</span>) <span class="ruby-operator">==</span> <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:opaque</span>]
    <span class="ruby-identifier">password</span> = <span class="ruby-identifier">password_procedure</span>.<span class="ruby-identifier">call</span>(<span class="ruby-identifier">credentials</span>[<span class="ruby-value">:username</span>])
    <span class="ruby-keyword">return</span> <span class="ruby-keyword">false</span> <span class="ruby-keyword">unless</span> <span class="ruby-identifier">password</span>

    <span class="ruby-identifier">method</span> = <span class="ruby-identifier">request</span>.<span class="ruby-identifier">env</span>[<span class="ruby-string">'rack.methodoverride.original_method'</span>] <span class="ruby-operator">||</span> <span class="ruby-identifier">request</span>.<span class="ruby-identifier">env</span>[<span class="ruby-string">'REQUEST_METHOD'</span>]
    <span class="ruby-identifier">uri</span>    = <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:uri</span>]

    [<span class="ruby-keyword">true</span>, <span class="ruby-keyword">false</span>].<span class="ruby-identifier">any?</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">trailing_question_mark</span><span class="ruby-operator">|</span>
      [<span class="ruby-keyword">true</span>, <span class="ruby-keyword">false</span>].<span class="ruby-identifier">any?</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">password_is_ha1</span><span class="ruby-operator">|</span>
        <span class="ruby-identifier">_uri</span> = <span class="ruby-identifier">trailing_question_mark</span> <span class="ruby-operator">?</span> <span class="ruby-identifier">uri</span> <span class="ruby-operator">+</span> <span class="ruby-string">&quot;?&quot;</span> <span class="ruby-operator">:</span> <span class="ruby-identifier">uri</span>
        <span class="ruby-identifier">expected</span> = <span class="ruby-identifier">expected_response</span>(<span class="ruby-identifier">method</span>, <span class="ruby-identifier">_uri</span>, <span class="ruby-identifier">credentials</span>, <span class="ruby-identifier">password</span>, <span class="ruby-identifier">password_is_ha1</span>)
        <span class="ruby-identifier">expected</span> <span class="ruby-operator">==</span> <span class="ruby-identifier">credentials</span>[<span class="ruby-value">:response</span>]
      <span class="ruby-keyword">end</span>
    <span class="ruby-keyword">end</span>
  <span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
        
        <div class="method">
          <div class="title method-title" id="method-i-validate_nonce">
            
              <b>validate_nonce</b>(secret_key, request, value, seconds_to_timeout=5*60)
            
            <a href="Digest.html#method-i-validate_nonce" name="method-i-validate_nonce" class="permalink">Link</a>
          </div>
          
          
            <div class="description">
              <p>Might want a shorter timeout depending on whether the request is a PATCH,
PUT, or POST, and if client is browser or web service. Can be much shorter
if the Stale directive is implemented. This would allow a user to use new
nonce without prompting user again for their username and password.</p>
            </div>
          
          
          
          
          
            
            <div class="sourcecode">
              
              <p class="source-link">
                Source: 
                <a href="javascript:toggleSource('method-i-validate_nonce_source')" id="l_method-i-validate_nonce_source">show</a>
                
                  | <a href="https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#L301" target="_blank" class="github_url">on GitHub</a>
                
              </p>
              <div id="method-i-validate_nonce_source" class="dyn-source">
                <pre><span class="ruby-comment"># File actionpack/lib/action_controller/metal/http_authentication.rb, line 301</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword ruby-title">validate_nonce</span>(<span class="ruby-identifier">secret_key</span>, <span class="ruby-identifier">request</span>, <span class="ruby-identifier">value</span>, <span class="ruby-identifier">seconds_to_timeout</span>=<span class="ruby-number">5</span>*<span class="ruby-number">60</span>)
  <span class="ruby-keyword">return</span> <span class="ruby-keyword">false</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">value</span>.<span class="ruby-identifier">nil?</span>
  <span class="ruby-identifier">t</span> = <span class="ruby-operator">::</span><span class="ruby-constant">Base64</span>.<span class="ruby-identifier">decode64</span>(<span class="ruby-identifier">value</span>).<span class="ruby-identifier">split</span>(<span class="ruby-string">&quot;:&quot;</span>).<span class="ruby-identifier">first</span>.<span class="ruby-identifier">to_i</span>
  <span class="ruby-identifier">nonce</span>(<span class="ruby-identifier">secret_key</span>, <span class="ruby-identifier">t</span>) <span class="ruby-operator">==</span> <span class="ruby-identifier">value</span> <span class="ruby-operator">&amp;&amp;</span> (<span class="ruby-identifier">t</span> <span class="ruby-operator">-</span> <span class="ruby-constant">Time</span>.<span class="ruby-identifier">now</span>.<span class="ruby-identifier">to_i</span>).<span class="ruby-identifier">abs</span> <span class="ruby-operator">&lt;=</span> <span class="ruby-identifier">seconds_to_timeout</span>
<span class="ruby-keyword">end</span></pre>
              </div>
            </div>
            
          </div>
                    </div>

    </div>
  </body>
</html>    